On September 22, 2026, the WordPress Security Team released an important security update addressing a critical vulnerability identified as CVE-2026-87902.
The vulnerability affects WordPress Core and, under certain conditions, can allow an unauthenticated attacker to make WordPress include a readable PHP file located outside the active theme directory.
Depending on the site’s theme and server configuration, this can potentially lead to code execution and complete website compromise.
This is not a vulnerability in a single plugin
One of the most important aspects of this issue is that it affects WordPress Core, rather than a specific plugin.
An attacker does not need a WordPress account to reach the vulnerable code path.
This does not mean that every unpatched WordPress installation can automatically be compromised through remote code execution. Exploitation depends on additional conditions involving the active theme and the server environment.
However, these conditions should not be considered a reason to postpone the update.
Which WordPress versions are affected?
WordPress has released security updates for multiple branches.
For example:
- WordPress 7.1.0–7.1.1 → 7.1.2
- WordPress 7.0.0–7.0.5 → 7.0.6
- WordPress 6.9.0–6.9.8 → 6.9.9
- WordPress 6.8.0–6.8.9 → 6.8.10
- WordPress 6.7.0–6.7.8 → 6.7.9
- WordPress 6.6.0–6.6.8 → 6.6.9
Security backports are also available for a number of older WordPress branches.
The important point is therefore not simply to check whether your WordPress installation is “recent”, but to make sure that it is running the appropriate patched release for its branch.
Why should you act immediately?
A vulnerability like this is particularly important because exploitation can occur without first compromising a WordPress account or exploiting a separate plugin vulnerability.
Furthermore, a compromised website does not necessarily show obvious signs of an attack.
An attacker may attempt to install malicious PHP code, create unauthorized administrator accounts, modify existing files, or use the server for additional malicious activity.
For this reason, updating WordPress is the first step, but it may not always be the only one required.
Have you already updated your website?
If you manage your WordPress website yourself, we recommend at least:
- checking the currently installed WordPress version;
- updating to the appropriate patched release;
- confirming that the update completed successfully;
- checking the website for errors after the update;
- reviewing server logs if suspicious activity is suspected;
- investigating the website if there are signs of compromise.
For business-critical websites, it is also worth reviewing the theme, plugins, PHP version and server configuration, because WordPress security depends on the entire environment, not just WordPress Core.
What if you don’t know whether your website is exposed?
This is a common situation.
A WordPress website may have been configured years ago and now contain dozens of plugins, a customized theme, legacy PHP settings, or components that are no longer maintained.
In these situations, simply clicking “Update” may not be enough.
We can help you check and secure your WordPress website
If you are unsure about the security of your website, you can contact us and we can carry out the necessary checks for you.
Depending on the situation, we can help with:
- checking the WordPress and component versions;
- applying security updates;
- checking compatibility between WordPress, themes and plugins;
- reviewing PHP and server configuration;
- checking website files for suspicious changes;
- investigating potential signs of compromise;
- reviewing administrator accounts;
- identifying outdated or suspicious plugins and themes;
- checking or configuring security and firewall solutions;
- carrying out a general WordPress security review.
The goal is not simply to “update WordPress”, but to bring the website back to a controlled and more secure state, reducing the risk that other vulnerabilities or configuration problems remain unnoticed.
What if you think your website has already been compromised?
In that situation, simply reinstalling WordPress or deleting a suspicious file may not be enough.
A compromise can leave behind backdoors, unauthorized administrator accounts, malicious code inside plugins or themes, and database modifications.
If you believe your website has been attacked, we can help with the investigation and recovery process, identifying what needs to be checked, cleaned or replaced.
WordPress security requires ongoing maintenance
This vulnerability is another reminder of an important principle: a WordPress website needs ongoing maintenance.
WordPress Core, plugins, themes, PHP, server configuration and security systems should be reviewed regularly.
A website that is secure today is not necessarily going to remain secure six months from now.
For this reason, in addition to responding quickly to critical security releases, many businesses benefit from having their WordPress environment regularly monitored and maintained by a technical professional.
Do you have a WordPress website and want to know whether it is up to date and secure?
Get in touch with us.
We can review your WordPress installation, apply the necessary updates and help identify security or configuration issues before they become a bigger problem.
It is better to address a security issue before it becomes a problem for your website, your customers and your business.